SynopsisA web application running on the remote host is affected by multiple vulnerabilities.
DescriptionAccording to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 3.1.x prior to 22.214.171.12423, 3.2.x prior to 126.96.36.1994, or 3.3.x prior to 188.8.131.529. It is, therefore, affected by multiple vulnerabilities :
- A denial of service vulnerability exists in the Apache Commons component in the FileUpload functionality due to improper handling of file upload requests. An unauthenticated, remote attacker can exploit this, via a specially crafted content-type header, to cause a denial of service condition. Note that this vulnerability does not affect MySQL Enterprise Monitor versions 3.3.x.
- An unspecified flaw exists in the Apache Struts component that is triggered during the cleanup of action names. An unauthenticated, remote attacker can exploit this, via a specially crafted payload, to perform unspecified actions. (CVE-2016-4436)
- A carry propagation error exists in the OpenSSL component in the Broadwell-specific Montgomery multiplication procedure when handling input lengths divisible by but longer than 256 bits. This can result in transient authentication and key negotiation failures or reproducible erroneous outcomes of public-key operations with specially crafted input. A man-in-the-middle attacker can possibly exploit this issue to compromise ECDH key negotiations that utilize Brainpool P-512 curves. (CVE-2016-7055)
- An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact confidentiality and integrity.
- An unspecified flaw exists in the Monitoring Server subcomponent that allows an authenticated, remote attacker to impact integrity and availability.
- An out-of-bounds read error exists in the OpenSSL component when handling packets using the CHACHA20/POLY1305 or RC4-MD5 ciphers. An unauthenticated, remote attacker can exploit this, via specially crafted truncated packets, to cause a denial of service condition. (CVE-2017-3731)
- A carry propagating error exists in the OpenSSL component in the x86_64 Montgomery squaring implementation that may cause the BN_mod_exp() function to produce incorrect results. An unauthenticated, remote attacker with sufficient resources can exploit this to obtain sensitive information regarding private keys.
- A remote code execution vulnerability exists in the Apache Struts component in the Jakarta Multipart parser due to improper handling of the Content-Type, Content-Disposition, and Content-Length headers.
An unauthenticated, remote attacker can exploit this, via a specially crafted header value in the HTTP request, to execute arbitrary code. (CVE-2017-5638)
SolutionUpgrade to MySQL Enterprise Monitor version 184.108.40.20623 / 220.127.116.114 / 18.104.22.1689 or later as referenced in the April 2017 Oracle Critical Patch Update advisory.
Note that the 3.2.x version was fixed for the CVE-2016-4436 vulnerability in version 22.214.171.1242.
File Name: mysql_enterprise_monitor_3_3_3_1199.nasl
Configuration: Enable paranoid mode
Temporal Vector: E:H/RL:OF/RC:ND
Temporal Vector: E:H/RL:O/RC:X
Required KB Items: installed_sw/MySQL Enterprise Monitor, Settings/ParanoidReport
Exploit Ease: Exploits are available
Patch Publication Date: 4/18/2017
Vulnerability Publication Date: 6/21/2016
CISA Known Exploited Dates: 5/3/2022
Metasploit (Apache Struts Jakarta Multipart Parser OGNL Injection)
CVE: CVE-2016-3092, CVE-2016-4436, CVE-2016-7055, CVE-2017-3306, CVE-2017-3307, CVE-2017-3731, CVE-2017-3732, CVE-2017-5638
BID: 91280, 91453, 94242, 95813, 95814, 96729, 97724, 97844